Wireshark-users: [Wireshark-users] Merge two pcap files
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: "Scott Sheppard" <scott.sheppard@xxxxxxxxxxxxxxxxx>
Date: Thu, 16 Aug 2007 17:46:24 -0000
Hello

I have two very big PCAP files. One is router 1 and the second is router 2.

I need to see both sides of a conversation A to Z is via Rtr 1 and Z to A is
via Rtr 2

I have processed each PCAP file and reduced size by filtering on the IP
address I need. This is File FBS00.pcap

(To save the filtered data I used Save As displayed etc)
I did the same thing for the data from Rtr 2 to file FBS01.pcap

I used the dos command 

Copy/b FBS00.pcap +FBS01.pcap Total.pcap

When I tried to study this merged file with Wireshark I was not able to load
all the information even though the number of frames was < 300

Any suggestions?

Thanks

Scott Sheppard